up vote 1 down vote favorite
1
share [g+] share [fb]

I'd like to make my flash drive read-only just for the root to stymie the Trojan Dropper autorun.inf's and bad EXE's on computers I'm fixing.

Anyone have any good ideas to keep from getting these Trojan Dropper files and autorun.exe's?

Thanks! -JFV

link|improve this question
83% accept rate
feedback

5 Answers

up vote 5 down vote accepted

There is a tool from Panda, which is called USB Vaccine and creates an unwritable autorun.inf file on your usb drive by abusing the FAT32 filesystem spec.

If you are using NTFS, you can just allow create folder and create files for child folders only. But keep in mind that usually those trojans will try to reset permissions to the root directory first (if they are running with Admin privileges or System privileges).

link|improve this answer
I used this and so far it's working well! Thanks for the info for USB Vaccine! – JFV Aug 19 '09 at 4:15
feedback
up vote 2 down vote

I assume that you are working on other people's machines and you want to be able to get data off of them onto your USB. In that case here is what I would suggest. Have one USB key that is completely read only. On that one put all your cleanup utilities. Clean up the machine removing Trojan Dropper, etc. Then have a second USB device that you pull the data to. You should also be turning off USB auto run on all your machines anyway so auto running viruses would not be a concern.

link|improve this answer
+1 for a good solution, but just a pain to implement (and update the cleanup utils and such). Thanks! – JFV Aug 19 '09 at 4:24
feedback
up vote 1 down vote

You can use an SD card reader. SD cards all have write-lock switches.

link|improve this answer
This is not solution for this question . I didn't understand how it will be helpful for this solution – joe Aug 17 '09 at 16:20
You'd use a SD card reader with an SD card in it. The PC will treat it as a USB flash drive (Mass Storage Device), but SD cards can be locked with a switch, effectively read-only-ing the entire drive. Instead of looking for a lockable USB drive, every normal sized SD card has a lock swtich. – Grant Aug 17 '09 at 17:12
feedback
up vote 1 down vote

This is issue happeneing because of Zlob.DnsChanger, Downandup, Downadup, Kido, Conficker.

Here they mentioned lot of solutions for this issue :http://www.exterminate-it.com/how-to-prevent-your-flash-drive-from-being-infected.

link|improve this answer
any reason for down vote ? – joe Aug 17 '09 at 16:19
Good info from the link... Not sure if the autorun.inf folder will hold up against these 'dropper' viruses though... – JFV Aug 19 '09 at 4:08
feedback
up vote 0 down vote

Some flash drives (like U3 enabled drives) come with a small partition that is read like a CD drive to the computer. This way the flash drive can load up software on computers that have CD autorun enabled, but Mass Storage Device (Flash drives) autorun disabled. That CD portion can be overridden with some work and effectively becomes a read-only section of the drive. It's not a whole lot of help in your case because A) there isn't a whole lot of room on the CD side and B) there is still a writable flash drive attached.

link|improve this answer
I guess , this drive also do auto run operations – joe Aug 17 '09 at 16:04
Yes, that's why it's not very helpful in this situation, but more options are better than less options, as long as all the benefits and weaknesses are pointed out. – Grant Aug 17 '09 at 17:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.